On 28 April 2022 the Indian Computer Emergency Response Team (CERT-In) issued Directions under sub-section (6) of section 70B of the Information Technology Act, 2000. They apply to service providers, intermediaries, data centers, bodies corporate and government organizations, which in practice means almost every company with systems in India.
Most attention goes to one line: report cyber incidents within six hours. The Directions ask for more than that, and the other duties are the ones that take months to put in place. This page sets out each one, with a plan for meeting the clock.
What the Directions require
| Duty | What it means in practice |
|---|---|
| Report within 6 hours | Report the listed types of cyber incident to CERT-In within six hours of noticing them or being told about them. |
| Keep logs for 180 days | Enable logs on all ICT systems and keep them securely for a rolling 180 days, to be provided to CERT-In with an incident report or when ordered. |
| Synchronize clocks | Connect to the NTP servers of NIC, the government informatics agency, or of the National Physical Laboratory (NPL), or to servers traceable to them, so every system keeps the same time. |
| Name a point of contact | Designate a person to deal with CERT-In and send the details in the format CERT-In specifies. |
| Act on orders | Take the action or provide the information CERT-In asks for, in the format and time it specifies. |
| Keep customer records for 5 years | Data centers, virtual private server, cloud and VPN providers keep subscriber details for five years or longer after the service ends. Virtual asset providers keep KYC and transaction records for five years. |
Which incidents must be reported
Annexure I to the Directions lists twenty types. They are broad, and a team should assume that anything it would call a security incident is on the list. In groups:
- Targeted scanning or probing of critical networks and systems, and compromise of critical systems or information.
- Unauthorized access to IT systems or data, including social media accounts.
- Website defacement or intrusion, and malicious code such as ransomware, bots, spyware and cryptominers.
- Attacks on servers such as database, mail and DNS, and on network devices such as routers.
- Identity theft, spoofing and phishing.
- Denial of service and distributed denial of service attacks.
- Data breaches and data leaks.
- Attacks on critical infrastructure, operational technology, wireless networks, IoT devices, digital payment systems, cloud systems, and systems related to AI, blockchain and virtual assets.
- Malicious and fake mobile apps.
When the six hours start
The clock starts when the organization notices the incident or is told about it, not when the attack began. A first report does not have to be complete. CERT-In's own FAQ says to send what is known within six hours and follow with the rest as the investigation continues.
The practical risk is the gap between an analyst noticing something and anyone with authority deciding it is reportable. Close that gap in advance: write down who decides, and let them decide on incomplete information.
- Record the time of detection in the ticket. That time is what you will be measured against.
- Classify against Annexure I. If it fits a listed type, it is reportable.
- Send the first report using the incident reporting form on the CERT-In website, by email to incident@cert-in.org.in. Include what was affected, when it was noticed, what is known and who to contact.
- Preserve logs and evidence before cleaning up. Our incident evidence checklist covers the order to do it in.
- Send updates as facts are confirmed, and keep a copy of everything sent.
Getting ready before anything happens
- Find out where logs are kept and for how long. Firewalls, VPN gateways, cloud audit trails, mail systems and identity providers often keep 30 or 90 days by default, which is short of 180.
- Check time settings on servers, network devices and cloud accounts. Timelines built from logs with different clocks cannot be trusted.
- Register the point of contact with CERT-In and name a deputy.
- Add the six-hour report to the incident response procedure as a named step with an owner.
- Run a tabletop exercise that starts at detection and stops when the first report is sent.
- Check contracts with providers. If a hosting or SaaS provider detects an incident in your environment, you need to hear about it in time to report.
If the Directions are not followed
Failing to provide information or comply with a direction is an offense under sub-section (7) of section 70B of the Information Technology Act, 2000. Read the current text of the Act for the penalty, since it has been amended. The Directions and CERT-In's FAQ are the authority on every point above. Confirm against them before relying on this summary.
Use it with
References
- CERT-In: Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, dated 28 April 2022, with FAQs
- CERT-In: Indian Computer Emergency Response Team
- The Information Technology Act, 2000 (India Code)
- NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide
This is general guidance for engineers and managers, not legal advice. Obligations depend on your sector, your contracts and the rules in force on the day, so confirm the current position with your counsel and the regulator before relying on it.